Aug 4, 2026: the keyv worm hit 12 unrelated orgs in 3h43m, and the poisoned builds carried valid GitHub Actions provenance. Why rotating credentials first is the thing that triggers the payload.
Checkmarx flagged 7 Vite-lookalike npm packages as ViteVenom. What actually triggers (bin/vite.js, not install), the Tron/Aptos/BSC C2 chain, and why npm v12 allowScripts and release-age gates don't stop it.
JFrog found 6 npm packages posing as Rollup polyfills. They install a second-stage package via CJS require(), not postinstall, then pull a RAT through JSONKeeper.
npm CLI 11.15.0 stages a tarball for maintainer 2FA approval before it hits the registry. Plus --allow-* install controls and how they differ from release-age gates and allowScripts.
postcss, nanoid and browserslist all ship from one npm account: 964M downloads/week, no provenance. Not a breach but a single-publisher risk — what moved to staged releases, and what to check in your lockfile.
Chainguard has blocked 52,000+ npm packages as malware or greyware, scanning 100,000+ a day, catching README-honest credential CLIs that release-age gates and npm v12 miss.
On June 17, 2026 Mastra's @mastra/* packages were re-published with an added easy-day-js dependency whose postinstall runs a RAT at install. Counts: 116 official vs 143–144 external.
npm v12 (July 2026) stops running dependency preinstall/postinstall and implicit node-gyp unless approved. How to list pending scripts with approve-scripts on npm 11.16, what allowScripts covers, and which supply-chain attacks it would have blocked.
GitHub disabled 73 Microsoft repos after an Azure/durabletask commit. Miasma used Claude Code, Gemini CLI, Cursor, and VS Code config, not npm install.
TrapDoor planted 34 packages across npm, PyPI and Crates.io to steal Solana/Sui/Aptos wallet keys. Each registry fires differently: postinstall, import-time, and Rust build.rs.
The May 19 Mini Shai-Hulud wave compromised 314 npm packages under @antv via the `atool` maintainer account. After rolling back lockfiles, payload entry points stay behind in .claude/settings.json SessionStart hooks, .vscode/tasks.json folderOpen tasks, systemd user services, and .github/workflows/codeql.yml. Concrete IoCs and the gh-token-monitor wipe ordering before rotation.
Mini Shai-Hulud-class npm hijacks live for 3-12 hours before takedown. pnpm 11.0 ships minimumReleaseAge=1440 (1 day) by default, Yarn 4.10 ships npmMinimalAgeGate=3d, npm v11.10 needs explicit min-release-age. Working .npmrc / pnpm-workspace.yaml / .yarnrc.yml configs and what breaks when ignore-scripts=true (esbuild, sharp, node-gyp, Cypress).
